In data-breach litigation, where a case is filed matters—and so does the harm alleged.
Businesses have won dismissals by challenging speculative injuries and weak links between breaches and alleged fraud. But Black v. IEC Group, decided October 9, 2026, underscores why a winning argument in one circuit may fall short in another—and why “no identity theft, no standing” is not a nationwide defense strategy.
The case: a misdirected email, not a cyberattack
IEC Group, which operates as AmeriBen, notified health-plan participants that an employee had emailed a spreadsheet containing their information to unauthorized recipients. The information included names, medical providers, dates of service and billing details.
The plaintiffs alleged that AmeriBen had promised to keep their information confidential. A federal district court dismissed their proposed class action for lack of standing, but the Ninth Circuit reversed. The alleged disclosure closely resembled the historically recognized wrong of breach of confidence, the panel concluded. “In short: a trust betrayed is the harm,” the court wrote. The distinction was critical: The claimed injury was the completed breach of confidence—not merely the possibility of identity theft later.
How Black fits with recent defense wins
Our recent articles have highlighted several decisions requiring plaintiffs to identify concrete harm and plausibly connect it to the incident:
• IBM and J&J: A New York federal court dismissed claims where plaintiffs failed to adequately allege concrete injuries traceable to the incident.
• Santos-Pagán v. Bayamón Medical Center: The First Circuit rejected an insufficient connection between a hospital breach and a fraudulent cellphone account. Fraud occurring after a breach did not establish that the breach caused it.
• Healthcare Interactive: Plaintiffs’ allegations of fraud and other consequences did not overcome deficiencies in connecting those harms to the information involved.
• Panighetti v. Intelligent Business Solutions: Allegations involving future identity-theft risk, mitigation expenses and emotional harm were insufficient under the circumstances pleaded.
Black does not erase those decisions. It recognizes a different theory: Under the circumstances alleged, disclosure of information entrusted in confidence was itself a concrete injury. “Actual injury” therefore does not necessarily mean financial injury.
Where the case is filed matters
A published Ninth Circuit decision governs federal district courts within that circuit, including California. It does not bind courts in other circuits, although they may find its reasoning persuasive. Likewise, a defense victory elsewhere does not automatically determine the outcome of a California federal case.
All federal courts apply the Supreme Court’s standing framework, but circuits can differ in how they evaluate intangible privacy injuries. Businesses should distinguish binding precedent from persuasive authority—and compare the actual injury theories and facts before treating different outcomes as a direct conflict.
The practical lesson: A nationwide incident requires a jurisdiction-specific litigation assessment, not a single standing argument recycled across courts.
Five takeaways for businesses
- Identify the injury actually alleged. Future fraud, completed identity theft and breach of confidence present different questions. Address each theory rather than relying exclusively on the absence of financial loss.
- Preserve data-specific facts. Determine what information was involved, who received or accessed it and what the investigation confirmed. Those details can support—or undermine—both injury and traceability arguments.
- Align confidentiality promises with actual practices. The alleged promises mattered in Black. Reviewing privacy notices, agreements and information-handling procedures is a practical response to that reasoning, not a checklist imposed by the court.
- Keep breach notices accurate and appropriately specific. Distinguish confirmed findings from possibilities while meeting notification obligations. The objective is precision, not minimizing the incident or withholding required information.
- Separate standing from liability. Black revived the lawsuit; it did not award damages, establish liability or certify a class. Claim-specific defenses and class-certification challenges remain separate inquiries.
The bottom line
Standing remains an important defense, but its strength depends on the alleged injury, the supporting facts and the governing circuit. After Black, businesses facing Ninth Circuit litigation must account for the possibility that the claimed harm is not what happened after disclosure—it is the breach of confidence the disclosure itself represents.
